Output Docker build hash.

When building ci-images, images on the host are sometimes (in the case
of the docker image, always) pulled from the registry (overwriting the
tag) but before pushing. So the image pushed is that pulled just now.
Instead save the build hash (and pretty much everthing else) and re-tag
before pushing (using the hash so it's the right image). While at it,
unify the Docker push jobs (the Docker Hub and the personal registry
one).